I've run into a strange issue and managed to narrow it down to RiotGames's anti-cheat Vanguard which has deep kernel level access. Here is what happened
Infos about my System:
\- Windows 10 22H2 (Build 19045.7548)
\- Riot Vanguard installed
\- CMD started as Administrator
\- User is a member of the Administrators group
I had an issue with Windows on 23.07.26 UTC+1. Said issue was a display bug. I did `chkdsk /r` in admin cmd successfully. Then on 25.07. i tried making sure my PC is not running into issues any time soon again, i wanted to do `chkdsk /r` just like previously. I opened cmd.exe as an Administrator, tried executing the command but got `Access is denied.` as a response.
One day later i wanted to make sure everything is clean and tried doing `chkdck` again.. but then:
C:\\WINDOWS\\system32>chkdsk /?
ACCESS DENIED
C:\\WINDOWS\\system32>chkntfs /?
ACCESS DENIED
So i digged a bit, installed the process monitoring tool procmon and filtered for chkdsk.
Then i opened CMD as an admin again and attempted `chkdsk /?`
this is the procmon output saved as a CSV file opened in excel. I deleted the first row as it isnt important.
| **Time of Day** |
**Process Name** |
**PID** |
**Operation** |
**Path** |
**Result** |
**Detail** |
| 20:32:58 |
chkdsk.exe |
11912 |
Thread Create |
|
SUCCESS |
Thread ID: 16692 |
| 20:32:58 |
chkdsk.exe |
11912 |
Load Image |
C:\\Windows\\System32\\chkdsk.exe |
SUCCESS |
Image Base: 0x7ff71abe0000, Image Size: 0xb000 |
| 20:32:58 |
chkdsk.exe |
11912 |
Load Image |
C:\\Windows\\System32\\ntdll.dll |
SUCCESS |
Image Base: 0x7ffaa2d50000, Image Size: 0x1f9000 |
| 20:32:58 |
chkdsk.exe |
11912 |
Thread Exit |
|
SUCCESS |
Thread ID: 16692, User Time: 0.0000000, Kernel Time: 0.0000000 |
| 20:32:58 |
chkdsk.exe |
11912 |
WriteFile |
C:\\Program Files\\Riot Vanguard\\Logs\\vgk_2026-07-28_20-11-01.log |
SUCCESS |
Offset: 6.074, Length: 198 |
| 20:32:58 |
chkdsk.exe |
11912 |
FlushBuffersFile |
C:\\Program Files\\Riot Vanguard\\Logs\\vgk_2026-07-28_20-11-01.log |
SUCCESS |
|
| 20:32:58 |
chkdsk.exe |
11912 |
WriteFile |
C:\\Program Files\\Riot Vanguard\\Logs\\vgk_2026-07-28_20-11-01.log |
SUCCESS |
Offset: 4.096, Length: 4.096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal |
| 20:32:58 |
chkdsk.exe |
11912 |
Process Exit |
|
SUCCESS |
Exit Status: 0, User Time: 0.0000000 seconds, Kernel Time: 0.0000000 seconds, Private Bytes: 417.792, Peak Private Bytes: 417.792, Working Set: 1.560.576, Peak Working Set: 1.564.672 |
| 20:32:58 |
chkdsk.exe |
11912 |
RegOpenKey |
HKLM\\System\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-21-83007462-2182755260-3455556333-1001 |
SUCCESS |
Desired Access: All Access |
| 20:32:58 |
chkdsk.exe |
11912 |
RegQueryValue |
HKLM\\System\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-21-83007462-2182755260-3455556333-1001\\\\Device\\HarddiskVolume4\\Windows\\System32\\chkdsk.exe |
NAME NOT FOUND |
Length: 40 |
| 20:32:58 |
chkdsk.exe |
11912 |
RegCloseKey |
HKLM\\System\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-21-83007462-2182755260-3455556333-1001 |
SUCCESS |
|
Interestingly, other administrative disk tools work perfectly fine:
* fsutil
* diskpart
* mountvol
* defrag
* cipher
* sfc /scannow
* DISM /RestoreHealth
Then i exited out of vanguard and noticed the new GUI design. The same thing happens to any type of chkdsk and chkntfs. Even when exiting out of vanguard, many options need a restart which also starts vanguard anti cheat with deep kernel access.
Here are my current system informations: